Workspace isolation
Every record is scoped to an organization and protected by Postgres Row Level Security on every table. Private documents, exports, and work-order media live in non-public storage and are served through short-lived signed links.
Application controls
- Server-verified authentication and workspace membership; email confirmation required; minimum 10-character passwords.
- Owner, admin, and member roles; destructive and billing actions require owner or admin.
- Server-side plan and usage enforcement; audit events for material workspace and lease actions.
- Human approval before extracted lease terms become active.
- Uploads limited to lease and bank-statement formats with size limits; every incoming webhook (Stripe, Plaid, QuickBooks, Telnyx, Resend) is signature-verified before it is processed.
- Bank and accounting access tokens are encrypted at rest with keys held only on the server.
Infrastructure
HTTPS everywhere with HSTS, a Content-Security-Policy, and hardened response headers. Hosting on Vercel and data on Supabase, both of which publish SOC 2 Type II reports; payments are handled by Stripe (PCI DSS Level 1) and card details never reach our servers. Provider credentials stay server-side, and dependencies are audited on every change.
Current status and limitations
TenantPoint itself does not yet hold a SOC 2 or ISO 27001 report; we rely on our providers’ attestations and maintain a written incident-response plan and vendor register. An independent penetration test is planned before general availability. Multi-factor authentication is available today as an opt-in: add an authenticator app in Settings, and every sign-in then asks for its six-digit code. We publish what is true today rather than what we intend.
Report an issue
Email hello@tenantpoint.co (or use the contact form) and do not access data that is not yours.